Oracle International Corporation

Himanshu Sharma

Arun Theebaprakasam

Buddhika Kottahachchi

Ramaprakash Hosalli Sathyanarayan

Sudhir Kumar Srinivasan

Fannie Ho

Olaf Stullich

Kuang-Yu Shih

Srikant Krishnapuram Tirumalai

Zhuoxing Mao

Zhe Wang

Balakumar Balu

Kwan-I Lee

Techniques for managing privileged accounts via a privileged access management service are provided. In some examples, the service may be configured with a plug-in framework for accessing secure resources. In some aspects, a log-in request that includes authentication information and corresponds to the service may be received. Session access to at least one secure resource may be provided when a user is authenticated. In some examples, a request to perform an action associated with the secure resource may be received during the session. Additionally, in some examples, the plug-in framework may be implemented to determine whether the user is allowed to perform the action. Further, performance of the action may be allowed or denied during the session based on the determination.

Privileged account plug-in framework&#x2014;usage policies

A privileged account manager is provided for monitoring privileged sessions on target systems of an enterprise. In an embodiment, the privileged account manager is configured to capture metadata related to a privileged session and generate a first activity pattern for the privileged session based on the captured metadata. The first activity pattern may include a sequence of one or more activities performed by a first user during the privileged session. The privileged account manager may be configured to identify a second activity pattern that comprises at least a subset of the one or more activities performed by the first user during the privileged session and determine an appropriate action to be performed for the first activity pattern based on the identification of the second activity pattern. In some embodiments, the privileged account manager may be configured to transmit the action to a second user on a client device.

Privileged session analytics

A cloud based identity management system that handles a plurality of published events that are published and consumed by microservices provides a dynamic queue that includes one or more active queues and one or more inactive queues. Embodiments create selectors for all of the active queues and the inactive queues and binds subscribers to each active queue. Embodiments dynamically cause at least one of the inactive queues to become one of the active queues when a number of published events increases.

Dynamic message queues for a microservice based cloud service

A system and method can monitor one or more user sessions on a target system in a computing environment. An account managing system can capture a plurality of user session screen captures that are associated with said one or more user sessions on the target system. Furthermore, the account managing system can compare a user session screen capture, which is captured at a time during said one or more user sessions, with one or more user session screen captures that are recorded before the time. Then, the account managing system can record said user session screen capture if the target system is determined to be active at the time when said user session screen capture is captured.

System and method for optimizing visual session recording for user account management in a computing environment

A system and method can support user account management in a computing environment. The computing environment can include a video encoding pool to support load balancing and a managing server, such as a privileged account manager server. The video encoding pool includes a set of nodes that are able to perform one or more video processing tasks for another node. Furthermore, the managing server can receive a request from a managed node in the computing environment for delegating a video processing task, and can select one or more nodes from the video encoding pool to load balance and to perform the video processing task.

System and method for supporting video processing load balancing for user account management in a computing environment

Techniques for managing privileged accounts via a privileged access management service are provided. In some examples, the service may be configured with a plug-in framework for accessing secure resources. In some aspects, plug-in code for implementing a workflow that includes step-up validation associated with a user attempting to access at least one secure resource may be received. Access to the at least one secure resource may be provided when the user is authenticated with respect to the service. In some examples, a request to access a second secure resource may be received. Additionally, in some examples, the workflow to perform the step-up validation may be implemented at least in response to the request to access the second secure resource. The workflow implemented based at least in part on an attribute associated with the request.

Privileged account plug-in framework-step-up validation

Techniques for managing accounts are provided. An access management system may check out credentials for accessing target systems. For example a user may receive a password for a period of time or until checked back in. Access to the target system may be logged during this time. Upon the password being checked in, a security account may modify the password so that the user may not log back in without checking out a new password. Additionally, in some examples, password policies for the security account may be managed. As such, when a password policy changes, the security account password may be dynamically updated. Additionally, in some examples, hierarchical viewing perspectives may be determined and/or selected for visualizing one or more managed accounts. Further, accounts may be organized into groups based on roles, and grants for the accounts may be dynamically updated as changes occur or new accounts are managed.

Privileged account manager, dynamic policy engine

A system and method can support user account management in a computing environment. A managing server, such as a privileged account manager server, can use an agent to manage a target system in the computing environment. The agent on the target system can initiate a video processing task based on a plurality of user session screens recorded on the target system, wherein the video processing task encodes the plurality of user session screens into a video. Furthermore, the agent can determine whether a resource usage for performing the video processing task on the target system exceeds a threshold. Then, the agent can dynamically offload the video processing task to a managing server that operates to manage the target system, if the resource usage for performing the video processing task on the target system exceeds the threshold.

System and method for supporting dynamic offloading of video processing for user account management in a computing environment

A system and method can support user account management in a computing environment. A user account manager can configure one or more recording policies, wherein said one or more recording policies operates to define detailed information on how user activities on a target system should be recorded. Furthermore, the user account manager can provide said one or more recording policies to one or more visual session recording processes associated with the target system. Then, the user account manager can use said one or more visual session recording processes to record activities in a user session on the target system based on said one or more recording policies.

System and method for using policies to support session recording for user account management in a computing environment

A system and method can support user account management in a computing environment. The computing environment can include a video encoding pool to support load balancing and a managing server, such as a privileged account manager server. The video encoding pool includes a set of nodes that are able to perform one or more video processing tasks for another node. Furthermore, the managing server can receive a request from a managed node in the computing environment for delegating a video processing task, and can select one or more nodes from the video encoding pool to load babalance and to perform the video processing task.

Growing community of inventors

Redwood Shores, CA, United States of America

Himanshu Sharma